US secret documents leaks on Discord originated around Youtuber-centered communitites

[Andrei Chiffa]

Summary

Following the news of secret documents leaks on Discord earlier this week, Bellingcat and to WaPo journalists decided to dig into the sources into the leaks and it looks like they gravitated around two minor youtube celebrities whose followers had a particular penchent for edgy shitposting.

 

Based on the reports, the source is a community centered around a small youtuber (Oxide ~130k subs). historically famous for playing wargames and currently in the military. Essentially a community of guys into weapons, geopolitics and shitposting, the toxicity of some of his fans got to Oxide and the resulting bans pushed the most toxic subset of his fans to a separate forum, where the secret documents were posted over a span of months.

 

From there, some of the documents were re-posted to a discord server of a self-proclaimed "shitposting internet microcelebrity" WowMao, from which they were reposted to a general Minecraft server - Minecraft Earth Map - before making their way to 4chan and Russian Milblogger telegram channel, who promptly re-posted them after editing Ukrainian casualties numbers.

 

The WaPo articles are painting the image of a community of lonely teens and young adults who congregated to discord servers during he pandemic to keep socializing and in the race to appear cool one to another decided to post secret documents they had access to through work (or declare they won't rat out their internet friends who did that, on-record, in clear-voice to a major news outlet).

 

 

Quotes

Belligcat from 9th of April:

Quote

In recent days, the US Justice Department and Pentagon have begun investigating an apparent online leak of sensitive documents, including some that were marked “Top Secret”. 

 

A portion of the documents, which have since been widely covered by the news media, focused on Russia’s invasion of Ukraine, while others detailed analysis of potential UK policies on the South China Sea and the activities of a Houthi figure in Yemen. 

[...]

However, Bellingcat has seen evidence that some documents dated to January could have been posted online even earlier, although it is unclear exactly when. Bellingcat also spoke to three members of the Discord community where the images had been posted who claimed that many more documents had been shared across other Discord servers in recent months.

[...]

There was only one image in common between the Telegram and 4chan posts: a map that showed a number of statistics, including the cumulative number of KIA (killed in action) soldiers on the Russian and Ukrainian sides through the course of the war. 

 

However, the numbers on these two sources differed, with the first source (4chan) showing more Russian losses than Ukrainian, and the second source (Donbass Devushka) the reverse.

A closer examination of the second image, with the much higher Ukrainian KIA numbers, that was posted on Telegram shows crude image manipulation. 

[...]

Bellingcat spoke to members of a separate Discord community who claimed that other images had been posted earlier on yet another, since deleted, server often called “Thug Shaker Central” but which also had several other names at different times. Image files shown to Bellingcat detailed a further document in the same style and formatting of those posted in the WowMao server that was dated to January 13. 

[...]

Their accounts of the server’s general nature also independently coincided. The name of the Thug Shaker server frequently changed, sometimes to that of a racial slur, and had around 20 active users making up a tight-knit community, members said. Posts and channel listings show that the server’s users were interested in video games, music, Orthodox Christianity, and fandom for the popular YouTuber “Oxide”.

 

WaPo from 12th of April 1:

Quote

Oxide, who said he is in his 20s and serves in the Army in the Pacific Northwest, said he started making videos a decade ago of video game clips when he was a teenager, then progressed into reviews and showcases of real-world military guns, tactics and equipment; ballistics tests of ammo and body armor; and reenactments featuring modern NATO and Russian special-forces gear.

[...]

One smaller channel, as with many larger communities, was also devoted to a rawer form of posting that is described by a scatological term, in which members troll each other, share memes and clown around.

 

After purging some of the worst trolls from his server, he said, some of them moved to the smaller offshoot server, Thug Shaker Central, where the leaked documents were first posted.

 

Oxide said that no documents were shared on his Discord and that he doesn’t know who leaked them. He wiped the entire server in recent days after a report from the investigative group Bellingcat linked his server to the leakers. He claimed to not know any names and doesn’t want to.

 

He said he has received no calls from any government investigators and worries the episode could affect his career.

[...]

He acknowledged the significance of his server’s involvement, saying the records related to “very groundbreaking and serious information concerning a tragedy happening right now.” But he also hoped that he could stay out of the public eye.

 

“I’m a s---posting internet microcelebrity and I’d like to keep it that way,” he said in the video.

[...]

 “A large part of my Discord are ‘edgelords,’ teenagers, right-wing teenagers — but, my god, they’re not terrorists. This isn’t an extremist group.”

 

WaPo from 12th of April 2:

Quote

The man behind a massive leak of U.S. government secrets that has exposed spying on allies, revealed the grim prospects for Ukraine’s war with Russia and ignited diplomatic fires for the White House is a young, charismatic gun enthusiast who shared highly classified documents with a group of far-flung acquaintances searching for companionship amid the isolation of the pandemic.

[...]

United by their mutual love of guns, military gear and God, the group of roughly two dozen — mostly men and boys — formed an invitation-only clubhouse in 2020 on Discord, an online platform popular with gamers.

[...]

The gathering spot had been a pandemic refuge, particularly for teen gamers locked in their houses and cut off from their real-world friends. The members swapped memes, offensive jokes and idle chitchat.

[...]

OG claimed he spent at least some of his day inside a secure facility that prohibited cellphones and other electronic devices, which could be used to document the secret information housed on government computer networks or spooling out from printers.

[...]

In those initial posts, OG had given his fellow members a small sip of the torrent of secrets that was to come. When rendering hundreds of classified files by hand proved too tiresome, he began posting hundreds of photos of documents themselves, an astonishing cache of secrets that has been steadily spilling into public view over the past week, disrupting U.S. foreign policy and aggravating America’s allies.

[...]

This account of how detailed intelligence documents intended for an exclusive circle of military leaders and government decision-makers found their way into and then out of OG’s closed community is based in part on several lengthy interviews with the Discord group member, who spoke to The Washington Post on the condition of anonymity. He is under 18 and was a young teenager when he met OG. The Post obtained consent from the member’s mother to speak to him and to record his remarks on video. He asked that his voice not be obscured.

[...]

Both members said they know OG’s real name as well as the state where he lives and works but declined to share that information while the FBI is hunting for the source of the leaks.

[...]

The Post also reviewed approximately 300 photos of classified documents, most of which have not been made public; some of the text documents OG is said to have written out; an audio recording of a man the two group members identified as OG speaking to his companions; and chat records and photographs that show OG communicating with them on the Discord server.

[...]

The young member was impressed by OG’s seemingly prophetic ability to forecast major events before they became headline news, things “only someone with this kind of high clearance” would know. He was by his own account enthralled with OG, who he said was in his early to mid-20s.

[...]

“He’s fit. He’s strong. He’s armed. He’s trained. Just about everything you can expect out of some sort of crazy movie,” the member said.

[...]

“I was one of the very few people in the server that was able to understand that these [documents] were legitimate,” the member said, setting himself apart from the others who mostly ignored OG’s posts.

 

“It felt like I was on top of Mount Everest,” he said. “I felt like I was above everyone else to some degree and that … I knew stuff that they didn’t.”

 

My thoughts

Looks like kids who grew up on the Navy Seal Copypasta are finally adults and after failing to become the actual Navy Seals are trying to pass of as ones among their online friend by leaking classified documents. 

 

I wonder how long before discords one is part of and youtuber one follows are join War Thunder in the latest questions on security clearances list and where LinusTechTips the LTT Minecraft Network would rank in that list.

 

I also wonder, what tips would be needed for the parent who gave a consent for their kid to be interviewed by WaPo on-record. Especially when their kid is saying they new the identity of the currently most wanted person in the USA, but won't give it to the authorities.

 

 

That also gives a more credence to Linus' obsession with what his kids do on the internet and who they interact with. Wonder if he would have additional tips for other parents wrt that. 

 

 

Sources

https://www.washingtonpost.com/national-security/2023/04/12/discord-leaked-documents/

https://www.washingtonpost.com/technology/2023/04/12/discord-documents-oxide-wow-mao/

https://www.bellingcat.com/news/2023/04/09/from-discord-to-4chan-the-improbable-journey-of-a-us-defence-leak/

https://cybervillains.com/@alex/110189659142649808